Does Oracle and OpenJDK both provide security patches and updates?

Oracle provides both Oracle binaries and OpenJDK binaries. Which community among these two provide faster java updates? And what is the time difference in the updates from both communitites?
Also, as both communities have their own set of users who report security issues to them, how does oracle provide security updates in both binaries? And is there any time gap between the security updates provided by Oracle and OpenJDK?
Does Oracle only provide security updates in its licensed version? Or does it also provide security patches with OpenJDK binaries?